I think for a while leading up to the recent session stealing hack, there has been a massive amount of positivity from Lemmy users around all kinds of new Lemmy apps, frontends, and tools that have been popping up lately.
Positivity is great, but please be aware that basically all of these things work by asking for complete access to your account. When you enter your Lemmy password into any third party tool, they are not just getting access to your session (which is what was stolen from some users during the recent hack), they also get the ability to generate more sessions in the future without your knowledge. This means that even if an admin resets all sessions and kicks all users out, anybody with your password can of course still take over your account!
This isn’t to say that any current Lemmy app developers are for sure out to get you, but at this point, it’s quite clear that there are malicious folks out there. Creating a Lemmy app seems like a completely easy vector to attack users right now, considering how trusting everybody has been. So please be careful about what code you run on your devices, and who you trust with your credentials!
Thanks for this!!
I feel like it raises somewhat the general issue of how much we’re willing to live with complete mysterious anonymity from all of the developers and admins in the fediverse. I’m not saying that every admin or developer should have their real identity revealed and linked here. But there’s a tension or issue here in how much it’s normal and accepted and how much the fediverse in general wants to grow and attract users that are accustomed to trusting large companies that provide a different kind of base level trustworthiness than makes sense “out here”.
If not links to real life identities (however trustworthy that can be in the limit), at least some connection to a broader online presence such that it becomes more likely the actor has something to lose in acting in bad faith (the lemmy core devs being a good example).
I don’t have a solution … but it seems to be a growing pain as this whole thing kind of grows from “hacker project” to “mainstream social media”.
The solution has been the same for the last 20 years: Use a password manager, do not reuse passwords. That’s it, you’re done.
Even if the Lemmy instance admin steals your password (which would be easy!) they can’t do anything with it.